Subject: RE: SMTP Minimum Retry Period - Proposal To Modify Mx

From: "Michel Py" <[email-masked]>
Date: Sun, 11 Jan 2004 19:20:18 -0800

> Keith Moore
> Somehow I doubt the IETF list cares enough to
> want to keep reading this exchange,

There's definitely some of the readers that are tired of reading you.

Michel.

---

From: Nathaniel Borenstein <[email-masked]>
Date: Mon, 12 Jan 2004 07:25:46 -0500

FWIW, I believe Keith is probably right.  Blacklisting has been a major 
impediment to my own email usage.  I don't know about any *particular* 
blacklisting service because when your ISP gets blacklisted by mistake 
and you're simply collateral damage, it's very hard for you to get an 
explanation of what's going on, because your email has been blocked -- 
this has happened to me several times.  My own theory is that 
blacklists are fundamentally flawed because they are inevitably NOT 
accompanied by sufficient administrative staff to deal with the 
inevitable mistakes and exceptions in the blacklist.  Moreover they 
aren't necessary, given the number of other ways to block spam.  -- 
Nathaniel

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 12 Jan 2004 10:49:58 -0700 (MST)

> From: Nathaniel Borenstein <[email-masked]>

> this has happened to me several times. 

Several times?  As far as I know, most people I know have never been
collateral or other kinds of blacklist damage.  Do you use what might
be called marginal ISPs?  Some large outfits such as UUNet have long
refused to care enough about spam.  (See the current Spamhaus listings
for UUNet at http://www.spamhaus.org/sbl/listings.lasso?isp=uu.net and
particularly the orange boxes.)

>                                         My own theory is that 

I have interests in other ways to block spam, but I don't like that
reasoning.  Many bad implementations don't prove the idea is hopeless.
The design and implementation flaws in practically all installations
of desktop software do not show that desk top computers are bad ideas.
All of us, including those who have never used a Microsoft product,
have been collateral damage of Microsoft's design philosophies,
implementation processes, and business plans, but that implies nothing
about personal computers in general or software from the Seattle area.

Before mail-abuse.org existed and I think before the RBL was called
the "RBL," it was pointed out to me.  I said that I couldn't imagine
a Fortune 500 company having an outsider decide which IP addresses
could send mail.  No matter how forcefully I would have said "Paul's
a good guy," if I'd been one of my bosses, I would have been unmoved.

But maybe that's just me.  All other (usable) ways to block spam
are being purchased as out-sourced services.  If you can trust
outsiders to have "sufficient administrative staff to deal with the
inevitable mistakes and exceptions" in a spam blocking mechanism
that is not blacklist, then why can't a blacklist be run properly?

The only thing that distinguishes blacklists from other third party
spam filters is that setting up a DNS blacklist is easiest.  Any fool
can set up a blacklist.  That many fools have and other fools have
used them does not show that blacklists are bad any more than the ease
of setting up an IP network shows TCP is the spawn of the devil.

Vernon Schryver    [email-masked]

---

From: "Randy Presuhn" <[email-masked]>
Date: Mon, 12 Jan 2004 10:21:22 -0800

Hi -

> From: "Vernon Schryver" <[email-masked]>
> To: <[email-masked]>
> Sent: Monday, January 12, 2004 9:49 AM
> Subject: Re: SMTP Minimum Retry Period - Proposal To Modify Mx
...
> collateral or other kinds of blacklist damage.
...

In the past, both the IETF disman and agentx mailing lists were adversely
affected because the domain in which they were then hosted was blacklisted.
It would not surprise me if other IETF mailing lists have had similar problems.
Outside the IETF, I've seen similar problems for mailing lists for INCITS
and ISO groups.  Depending on the list software in use and how the hosts
using the blacklists are configured, the working group members, and even
the mailing list administrator, may be completely unaware that some group
members are not getting all (or any) posts unless they compare what
they've received with the mailing list archive.

A particularly nasty kind of damage occurs when web forms use email
confirmation.  Last year I had some grief because a national railway
company in Europe was using a service that blacklisted mindspring.com.
I couldn't complete the transaction until I confirmed my email address,
but I couldn't confirm my email address because they had blocked the
domain.

Randy

---

From: Nathaniel Borenstein <[email-masked]>
Date: Mon, 12 Jan 2004 14:51:43 -0500

On Monday, January 12, 2004, at 12:49  PM, Vernon Schryver wrote:

> refused to care enough about spam.

The ISP in question was XO -- marginal by some standards, perhaps.  But 
as I tried to mediate the dispute, I found XO acting much more 
responsibly than Road Runner, which was blocking them.

I also have to say that I fear your approach would help the larger ISPs 
use spam as an excuse to kill off smaller ISP's...  and I question the 
fundamental legitimacy of blocking all of an ISP's customers before 
there's a fair due process to establish the ISP's culpability.  "Caring 
enough about spam" is an awfully slippery concept on which to base a 
blacklist.

> If you can trust

Good point.  That's why I favor giving users access to their spam pool 
when they suspect problems, and using challenge/response in certain 
(carefully defined) situations.  A good filtering mechanism is not 
nearly as black and white as a blacklist.

> Any fool

I will confess that my personal experience makes it very hard for me to 
be rational on the subject of blacklists, as I fear that any concession 
to them will only encourage the creation of destructive blacklists by 
"fools".  In general I prefer a solution that any fool can implement, 
because one surely will.  -- Nathaniel

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 12 Jan 2004 13:51:08 -0700 (MST)

> use spam as an excuse to kill off smaller ISP's...  

How so?  Exactly what is my approach?  Please note what I've said too
many times:
  - I don't currently use a public blacklist and have never used one
      for non-trivial mail.
  - I'm flogging spam defenses that compete with blacklists.

>                                                  and I question the 
> there's a fair due process to establish the ISP's culpability. 

"Fair due process" and "free speech" and even "legitimacy" are none
of your concern unless you own the mailbox that would *RECEIVE* the
blocked mail.  No one has any right to send anyone any mail.  We have
only privileges granted by targets of our mail.  If our targets are
foolish and hire ISPs with long histories of both permitting a lot of
outgoing spam and blocking a lot of incoming legitimate mail (see
recent complaints about RR's false positives), then that's just tough
and perhaps we should convince our correspondents to switch ISPs or
find new correspondents.

Good or bad spam filtering is merely a part of the rest of good or bad
SMTP or any other ISP service.  It makes no more sense to condemn the
HTTP protocol because many web pages are junk than it does to condemn
blacklists because some blacklists are junk or used badly.

If you think blacklists are bad because they can be run by fools, then
you also must hate any network authentication and authorization
mechanism.  What's the difference between Kerberos and a mail blacklist?
Both are responsible for summary denial of services.

I fear there are bad reasons for the disdain for blacklists:
 - they are effective against spam from spam friendly ISPs.
 - some of us work for spam friendly ISPs and let the interests of
    our employers color our thinking.
 - some of us are lazy and hire ISPs have been spam friendly.
 - some of us feel we have a devine right to send any mail to anyone
    and are deeply offended by any contrary suggestion, not to mention
    an effective mechanism.

>                                                             "Caring 

I am offended by your implication that I suggested any such thing. 
I only pointed out that using spam-friendly ISPs has consequences.
(You evidently know about XO's reputation, which I think has improved
lately.)  The only major blacklist that does anything remotely like
your implication is SPEWS, which "escalates" in order to get the
attention of ISPs.  If I did use a blacklist, it wouldn't be SPEWS but
that would be only one reason among serveral.

> nearly as black and white as a blacklist.

The last part of that is simply wrong.  Every filtering mechanism is
exactly as black and white as a blacklist.  Whether or not an SMTP
server keeps good logs has nothing to do with whether it decides to
reject messages using blacklists of IP addresses or domain names or
anything else.  If your correspondents use software that consults any
blacklist but doesn't keep good logs, then the fault lies first with
your correspondents for using bad software, second with you for having
foolish correspondents, and not at all with the blacklist.

Yes, I realize that I'm implying that to keep good logs you need to
act on a blacklist (if you use one) at the end of the DATA command
instead of before the HELO.

> because one surely will.  

Then you'd better give up on the Internet.  As with much of the net,
the information in and functioning of any spam system is at least
somewhat "administrative" and subject to the whims of any fools
administrating it.  The buyer must beware, not only of hiring a spam
friendly ISP, but contracting with a foolish spam filter.  The greater
fool is often the buyer of services offered by lesser fools.

---

From: Nathaniel Borenstein <[email-masked]>
Date: Mon, 12 Jan 2004 16:57:16 -0500

[my final message to the list on this thread]

On Monday, January 12, 2004, at 03:51  PM, Vernon Schryver wrote:

> How so?  Exactly what is my approach?

I'm sorry, you're right, that was totally unfair.  I meant blacklists, 
because you were arguing for them, but that doesn't make "your 
approach" synonymous with blacklists.  My apologies for trivializing 
your position.  s/"your approach"/blacklisting/

> of your concern....

I don't want to burden the ietf list with an argument over the nature 
of liberty, but I'd be happy to have that discussion privately if you 
like.

> mechanism.

That's only a slight overstatement, actually.

> I am offended by your implication that I suggested any such thing.

I am sorry if I misinterpreted.

> Then you'd better give up on the Internet.

That's a tad oversimplified, isn't it?  Was Yosemite doomed when the 
first candy wrapper was dropped in the valley?  -- Nathaniel

---

From: Bill Sommerfeld <[email-masked]>
Date: Mon, 12 Jan 2004 17:31:53 -0500

> (carefully defined) situations.  

> A good filtering mechanism is not nearly as black and white as a blacklist.

so, you're conflating two things here:
 1) the access control criteria (message source address in blacklist
 vs. "bad" message content as determined by various heuristics).

 2) what happens to the message once the access control decision is
made (rejected at SMTP layer; accepted but bitbucketed; accepted but
quarantined; accepted and placed in regular mailbox; etc.).

you can (and spamassassin does) uses DNSBL's as part of a "not black
and white" decision process, and you can implement both strategies.

One problem with dropping suspected spam into a spam cesspool as
opposed to rejecting it outright in the SMTP session is that many
people (myself included) have neither the time nor the inclination to
wade through our spam cesspools on a regular basis looking for
misclassified messages.

An SMTP-level reject at least gives the sender a real-time indication
that the recipient will not be seeing the message any time soon..

						- Bill

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 12 Jan 2004 16:50:27 -0700 (MST)

> From: Bill Sommerfeld <[email-masked]>

> wade through our spam cesspools on a regular basis looking for

That's too true.  Since the spam collected/rejected by my real mailbox
and personal spam traps exceeded 1000 spam/day, I can only skim envelopes.
If I count duplicates, my average for the last 40 days is 3516/day.

> that the recipient will not be seeing the message any time soon..

There may be a false dichotomy there.  You can reject a message during
the SMTP transaction and so give the sender a real-time indication while
also capturing the entire message in a spam cesspool.  All 787 MBytes
now in my 40-day rolling cesspoll were rejected with a 5yz or 4yz SMTP
response.  That many systems don't capture what they reject implies
nothing about anything except those SMTP servers.

I'm flummoxed by criticism of external DNS blacklists based on the
lack logging by SMTP servers.  That's predictable among the general
public, but not here.

This thread is related to the nearby thread about the end of life
announcement for SpeakFreely.  The problem in both cases is less with
evil media conglomerates converting the Internet into TV than with people
who won't feed themselves.  Instead of getting their code and networks
running IPv6, they install NAT boxes and complain about the RIAA.
Contrary to the whines from ISPs with major spam problem, those that
have real (including enforced) anti-spam policies don't have spamming
customers.  Instead of paying the extra cost to hire an ISP that cares
enough to not have spamming customers, people complain about the evils
of blacklists.  Instead of taking the extra trouble to use an operating
system or at least an MTA that is not a worm delivery and spam
facilitation system, they send mail to random, spam-obsessed strangers
like me asking how to add spam filtering to Outlook.

---

From: [email-masked] (Mike S)
Date: Mon, 12 Jan 2004 20:31:19 -0500

At 06:50 PM 1/12/2004, Vernon Schryver wrote...
>Instead of paying the extra cost to hire an ISP that cares
>of blacklists. 

Feh. Once again with the incorrect assumptions. I don't spam. I would preferentially route email direct for two main reasons: 1) privacy - routing via my ISP's outbound SMTP gives them the right to intercept and read my email, according the ECPA; 2) control - sending from my own system allows me to control retry attempts and times, instead of being forced to wait 4 days for my ISP to bounce an undelivered back to me, assuming they don't just silently lose it.

I can't do so because my IP address is on a blacklist. I have cable modem, but the world thinks I'm a dial-up. For that reason alone, having nothing whatsoever to do with spam, I'm forced to give up privacy and control of my communications.

"Anti-spam" initiatives that are based on such blacklists are quite simply the failed results of irrational, fascist thought. Regardless of your exact definition of spam, all reasonable ones I've heard have one thing in common - it's based on CONTENT, not IP address. Blacklists couldn't care less about content - legitimate email or spam, out it goes, to the detriment of communications.

They also, quite clearly, don't work to eliminate spam.